The majority of security problems in app development are really software quality problems. There’s something wrong with the way the code was written that leaves a door open for someone to exploit. Fortunately, many of these problems can be easily fixed. Some of these can be fixed in the design phase of product development and others in the code phase. We’ll explore a few examples of each type in this post.

The Objective of this Post

Now, before we jump in, I need to confess that this is a broad and deep subject. My goal here is to present a high-level understanding of code security through discussion and a few examples that will help you understand the kinds of vulnerabilities that can lead to problems. I will also provide references to further reading for those that really want the “Full Monty” on developing secure apps.

Code Security at Design Time

1. Design with security in mind. This is perhaps the most important thing you can do. Think about the following questions before you design your code and have answers for all of them:
   • What Assets does this software need to protect? Credit Card numbers, user data, contact lists, account info, access to paid services, and privileged access to device. To protect sensitive assets, you need to plan how you’re going to deal with the data at design time. If you’re sending sensitive data over a computer network, you should use SSL/TLS protocol to prevent attackers from eavesdropping. Look into OpenSSL for open source libraries and code examples on how to use this protocol. Also, for server-side storage, consider using a 3rd party database such as MySQL. These systems have their own built-in security policies that you can leverage. Also, for secure authentication, leverage trusted services like OAuth and OpenID (See Additional Resources for more info below)
   • How might an attacker exploit my code? This is often called “Thread Modeling”. Attackers might be eavesdropping on the network ports you use, or providing unexpected inputs that overflow memory buffers and inject attacker-supplied code to be executed. You have to ensure, for example, that you never execute code on behalf of an untrusted user
2. Follow a Secure Coding Standard – Select a secure coding standard and make sure your code conforms. A secure coding standard will identify specific issues with a particular programming language that a compiler or analysis tool might fail to diagnose. Secure coding standards also define requirements for producing code level security in your system. Several popular secure coding standards are available from CERT® on their website at www.securecoding.cert.org.
3. Perform Design Reviews. This is a simple thing teams can do, and it can really pay off in the long run. A few years ago, I managed a couple of engineering teams at Sun and when a new code module was planned. The engineering lead would present the design to a team of Senior Architects with different backgrounds (JVM, networking, platform architecture, etc.). This always uncovered potential problems –and did so early on before they became big problems that were expensive to fix.
4. Understand Emerging Threats. Pay attention to the type of exploits that are popular, and make sure you’re not helping the bad guys. Designate one person on your team to stay up to date on the current security trends and put her/him in the code review. A great place to start is by visiting the CERT website frequently and becoming familiar with all the resources they offer. In addition, all major platform and OS providers publish security updates from time to time as issues are uncovered.
5. Use Static Analysis Tools. Static code analysis can really help locate many kinds of software validation and reliability problems, including many memory problems. Some examples of companies that provide these products include: Klocwork and Coverity, Parasoft, and Vericode. A more complete list can be found here: http://www.cert.org/secure-coding/tools.html

If you’re doing all these things, you’re actually doing pretty well. You’ve got a solid design, you’re following a secure coding standard, you’ve got someone keeping an eye out for potential security exploits, and you’re conducting design reviews and running static analysis tools on a regular basis. You’ve got the design side covered pretty well. Now let’s look at some specific code issues that can cause problems.

Code Security at Development Time

Most of the following examples demonstrate some of common problems found in native C and C++ development. Web developers and Java developers can still benefit as the concepts behind the problems are valid in many languages. In the Additional Resources section below, I provide links to specific Web and Java resources for code security.

1. Application Frameworks

   Use application frameworks whenever possible. Frameworks hide a lot of the nasty memory management and secure network connection issues from the developer and reduce the possibility of making simple, but costly, mistakes. Fortunately, the BlackBerry platform supports a lot of great developer frameworks, both from BlackBerry (such as the Invocation and Share Framework, and the UI Framework Cascades) and through BlackBerry’s Platform Partners.

2. Memory Management

   Aside from the obvious allocation of memory insufficient for the data you’re writing into it, there’s a common issue people new to C and C++ sometimes experience regarding memory management. The problem occurs when you confuse which action you use to release the memory you’ve allocated.

   Using Cascades will reduce the likelihood of memory management problems because it hides all the messy details for you within the framework. However, if you must allocate memory yourself for your app, keep the following tip in mind.

   There are two main C functions for allocating memory: malloc() and calloc(). Use malloc() when you don’t care about initializing the data in memory. Use calloc() if you want to initialize the memory to 0. The important thing to remember is when using either malloc() or calloc(), you must use the function free() to release the memory and give it back to the system.

   In contrast, when using the C++ method new() to create a new object, you must use the corresponding delete() method. Nothing good can happen when you call free() on memory you’ve created using new().

3. Function Safety

   The QNX platform provides a number of preferred C functions that are safer to use than the more commonly known standard functions. A subset of these is shown in the table below. You can find the complete list in the BlackBerry Native SDK online docs (referenced in Additional Resources section below).

   As with memory management, using an application framework helps with function safety as well. For instance, the Cascades classes such as QString and QByteArray protect you from many of these problems as well.

   As you’ll see in these examples, most of the serious problems occur when buffers you’re reading into or writing out to are not large enough to take the data. These functions below help you from over-writing some of the time. You should always perform bounds checking if you want to be on the safe side.

   Unsafe Function(s)	Preferred Function(s)	Comments
   strcpy() and strncpy() strcat() and strncat()	strlcpy() and strlcat()	The function strlcpy() copies strings and the function strlcat() concatenates strings. They’re designed to be safer, more consistent, and less error-prone replacements for strncpy() and strncat(). Unlike those functions, strlcpy() and strlcat() take the full size of the buffer (not just the length) and guarantee to NUL-terminate the result (as long as the size is larger than 0 or, in the case of strlcat(), as long as there’s at least one byte free in the destination string). There also exist “wide” versions of these functions that are equally dangerous: wcscpy(), but there is no “l” safe version to use, only wcsncpy() which does not necessarily NUL-terminate the output. Care must be taken to ensure the output buffer is NUL-terminated.
   sprintf() and vsprintf()	snprintf() and vsnprintf()	The snprintf() function is similar to fprintf(), except that snprintf() places the generated output (up to the specified maximum number of characters) into the character array pointed to by buf, instead of writing it to a file. The snprintf() function is similar to sprintf(), but with boundary checking. A null character is placed at the end of the generated character string.
   gets()	fgets(buf, n, fp)	The fgets() function reads a string of characters from the stream specified by fp, and stores them in the array specified by buf, limited to size n.
   getwd()	getcwd(buffer, size)	The getcwd() function returns the name of the current working directory. buffer is a pointer to a buffer of at least size bytes where the NUL-terminated name of the current working directory will be placed. The maximum size that might be required for buffer is PATH_MAX + 1 bytes

4. Structures

   Structures in C and C++ are aggregated types that define and contain other data elements within them. The elements of a structure cannot be re-ordered by the compiler. Modern compilers do use a variety of methods to minimize the security risk of stack-buffer overflows such as stack canaries, address-space layout randomization, re-ordering the local variables within a function, among other things. However, since the compiler can’t re-order the elements within your structures, the possibility of a buffer overflow on one of your elements affecting function parameters or local variables remains. Consider the following example:

   struct _JOB {
               char name[64];
                           char title[64];
               DATE startdate;
               DATE enddate;
               WAGE salary;      
           } JOB, *PJOB;

   The buffers name and title can both overrun. Since they’re placed on the stack first, the elements defined after them in the structure and on the stack itself can be affected. For this reason, care should be given when defining the elements in a structure. The next example shows a structure that’s defensively designed:

   struct _JOB {
               DATE startdate;
               DATE enddate;
               WAGE salary;  
               char name[64];    // Buffers placed at end 
                           char title[64];   // of struct definition
   
           } JOB, *PJOB;

   Recommendations for using structures

   When dealing with structures that contain fixed-width buffers or arrays designed to receive data that’s controlled or influenced by a user:

   • Buffers and arrays in structures should be grouped at the end of the structure
   • Local variables declared as structures should be declared after local buffers but before any other local variables
   • Global variables declared as structures should be declared before any global buffers and arrays and after any other global variables
   • Pointers to structures do not need any special consideration
   • Where practical, try to minimize the number of local variables cast as structures with buffers and arrays as elements

5. Macros

   Macros are one of my favorite mechanisms in C and C++. I love using them; however, you have to be very careful as they can get you into trouble. Macros are defined through the use of the #define preprocessor directive and when processed, literally expand in your source code prior to compilation. If IDE’s could show you what the processed source code looked like (maybe some do?), then I suspect we’d see fewer problems. Consider the following example that demonstrates the issue:

   #define CUBE (x*x*x)
   …
   int x = CUBE (5-2)

   In this example, you might expect that you’re going to get the cube of 3 which is 27. However, when the preprocessor expands the macro, normal operator precedence rules apply. So, here’s how that the value of x will be calculated:

   CUBE(5-2) = (5 – 2*5 – 2*5 – 2)
   CUBE(5-2) = (5 – 10 -10 -2)
   CUBE(5-2) = -17

   Therefore, to protect against this problem, the macro can easily be defined using parentheses as in:

   #define CUBE(x)   (x)*(x)*(x)

   In this example, we’ve seen how operator precedence rules can get you into trouble with macros. There are other problems such as the importance of white space when defining macros, using macros in if statements, and self-referencing macros to name a few. Provided you think about how the macro will expand in your source and you consider how the arguments you pass to macros will be interpreted in that expansion, you should be fine.

6. Integers (signed, unsigned) and Enumerations

   Another common problem that can expose serious threats to your code involves integer overflow or underflow. This can happen when care is not taken with integers. The following code fragment demonstrates how serious this problem can be (recall our discussion about buffer sizes above):

   int buffLen = 0;
   printf(“[buf] %d %u\n”, buffLen, buffLen);
   buffLen = -1;
   printf(“[buf] %d %u\n”, bufflen, bufflen);

   Executing this code gives:

   [buf] 0 0
   [buf] -1 4294967295

   In this example, I forced the value of bufLen to be -1 for demonstration purposes. But, it’s easy to imagine a simple arithmetic error in a length calculation to be off by one.

   Similar problems arise with the use of Enumerations. Not all compilers use the same kind of “int” for Enumerated types. So, you need to be careful when using Enumerations. Make sure you know how your compiler treats them. If your compiler uses signed integers by default (such as Microsoft Visual C++ and ARMCC), it’s not possible to create an unsigned enumeration as the value will be overflow the signed int (for example, you can’t set the enumerated value to be 0xffffffff).

Summary

Though we’ve just scratched the surface of this topic, we’ve discussed a number of things developers can do to protect their code from security problems.

We’ve explored good practices developers can adopt at design time, such as:

• Design with security in mind
• Follow a Secure Coding Standard
• Perform Design Reviews
• Understand Emerging Threats
• Use Static Analysis Tools

We’ve also looked at some common coding mistakes that can lead to security problems and discussed how the code can be fixed to avoid these problems. We’ve seen how leveraging Application Frameworks (like Cascades) can greatly reduce security problems. As an app developer, you have a responsibility to protect your user’s identity and sensitive data as best you can from attackers seeking to exploit it. The content in this blog post should help you get started with some good practices and links to learn more.

For more information on application security, additional examples, and deeper analysis, please refer to the additional resources below.

Additional Resources

• BlackBerry Native SDK Online Docs. Security Considerations for Native Application Development
• QNX Online Docs, Neutrino C Library Reference
• Chad Tetreault, Say It Aint S’OAuth, in BlackBerry Dev

Blogs

• Software Engineering Institute | Carnegie Mellon http://www.sei.cmu.edu/
• Seacord, Robert. The CERT C Secure Coding Standard, Addison Wesley, 2008
• Seacord, Robert. Secure Coding in C and C++, 2nd Edition, Addison Wesley, 2013.
• Mark Dowd, John McDonald, Justin Schuh, The Art of Software Security Assessment

Acknowledgements

I’d like to thank Robert Seacord for taking the time to read an early draft of my blog and provide helpful feedback. Robert is a senior analyst in the CERT Program at the Software Engineering Institute (SEI) in Pittsburgh, PA where he leads the Secure Coding Initiative and is author of a number of books on Secure Programming. I’d also like to thank the BlackBerry Security team for their insightful comments and suggestions.

With the latest development approaches and technologies from SAP and Research In Motion, we have made cross device development easy – taking existing enterprise applications and porting them over to multiple BlackBerry devices (both past, current, and future), while all connecting into the enterprise back-end for the latest data and updates. This enables organizations to take desktop applications, and mobilize them to provide road warriors with the same up to date data, and even additional capabilities using features included on mobile devices that are not available on desktop computers – features such as GPS for example.

Watch the video below, where Jim Ing (Enterprise Mobility Architect, RIM) and Pete Graham (Director of Finance Solutions & Mobility, SAP) will take you through the approaches SAP has used to successfully develop, and port their applications across past, present, and future BlackBerry smartphones and the BlackBerry PlayBook tablet.

[ YouTube link for mobile viewing ]

For more on BlackBerry development tools and resources visit BlackBerry Developer Zone at www.blackberry.com/developers, and for more on SAP mobile applications please visit www.sap.com/mobile.

Now I’m here to talk about how you can integrate your BlackBerry® WebWorks™ application with the BBM SP. Most of what will be covered is available to both BlackBerry® OS 5-7 and BlackBerry® 10 applications. However, at the time of writing some of the BBM SP APIs discussed here are available only for BlackBerry OS 5-7 applications — I’ve noted where this is the case. We are planning on adding these to the BlackBerry 10 WebWorks SDK as well.

Testing a BBM SP application for BlackBerry 10 currently requires a real device. We’re working on adding BBM SP support in the BlackBerry 10 simulator and this should be available before the end of 2012. Support for testing BlackBerry OS 5-7 applications that use BBM SP is supported in many BlackBerry smartphone simulators we have available today, so ensure you download one that lists support for BBM.

Configure Your Project

The BlackBerry 10 WebWorks SDK includes everything you need to get started. If you have a BlackBerry OS 5-7 application, you’ll need to download the BBM SDK v1.1 for BlackBerry WebWorks in addition to the regular BlackBerry WebWorks SDK for Smartphones. Instructions for connecting these two SDK for targeting BlackBerry OS 5-7 can be found in Getting Started: BlackBerry WebWorks Development for Smartphones and the BBM Social Platform.

In order for your application to access to the BBM SP APIs, you’ll need to request the appropriate permissions in your application’s config.xml file. There are two elements you’ll need to add: bbm_connect for rim:permissions and blackberry.bbm.platform for feature. Here is what it looks like:

<rim:permissions>
	<rim:permit>bbm_connect</rim:permit>
</rim:permissions>
<feature id="blackberry.bbm.platform" />

Register with the BBM Social Platform

Registration is the first step in connecting to the BBM Social Platform, which involves an application registering itself with the RIM-hosted BBM infrastructure. A BBM sample is available on the BlackBerry github site that demonstrates BBM SP registration along with the invite to download feature. Have a look at it once you’ve finished reading this section for the complete version of the code snippets used here.

When using BlackBerry WebWorks, the first thing to do is to register for the onaccesschanged event. If you try to register before registering for this, an IllegalStateException is thrown. Here is how you can register for this event:

blackberry.event.addEventListener("onaccesschanged", function (accessible, status) {
	if (status === 'allowed') {
		/* Access allowed. */
	} 
});

This code sample only catches the allowed status. Your application would need to handle disallowed status that could be caused by the user being out of coverage or if the user disallowed access to BBM. The BBM sample demonstrates how to catch the other statuses.

Each application must define its own Universally Unique Identifier (UUID) so that it can uniquely identify itself. This UUID is used to register with the BBM SP servers during testing and development. Applications in the BlackBerry App World™ storefront are assigned their own UUID automatically. You can generate a UUID using various web sites, such as the one here. In BlackBerry WebWorks, the UUID is stored in the options parameter used in registration.

options = {
	uuid: "33490f91-ad95-4ba9-82c4-33f6ad69fbbc"
};

Now we’re ready for the final step in the registration process, which is to call the register method using the options parameter we defined above. This will trigger the onaccesschanged event.

blackberry.bbm.platform.register(options);

Invite to Download

The invite to download feature allows users of your application to invite their BBM contacts to download your application from BlackBerry App World. The recipient receives the invitation through a BBM Chat session, which includes a message provided by the application and user sending the invitation. This is one of the easiest features to implement. After you’ve registered, you can do this with just one method call.

blackberry.bbm.platform.users.inviteToDownload();

Note that for this to work between BlackBerry 10 and BlackBerry OS 5-7 users, the SKU in BlackBerry App World for the two releases of the application (BAR and COD) must be the same.

Profile Integration

BBM SP allows for both read and write access to the user’s BBM profile. This allows your application access to their profile message, status text, availability and avatar image. Here are a few examples of how to use these APIs:

This first code sample shows how to access the image the user has set for their BBM profile.

blackberry.bbm.platform.self.getDisplayPicture(function (image) {
    // do something with the image here
});
Now let’s look at how your application could update the user’s BBM profile picture.
blackberry.bbm.platform.self.setDisplayPicture("local:///smiley.jpg", function (accepted) {
    if(accepted) {
        // User allowed the change
    } else {
        // User denied the change
    }
});

If an update to a personal message was made from an application other than the BBM Client, a tag is shown under the update stating the name of the application that performed the update. Users can click on that tag to download the application from BlackBerry App World. This requires the sender to have installed the application from BlackBerry App World, so that tag won’t take you to BlackBerry App World if you side loaded your application for testing. Let’s take a look at how to update the personal message and status.

blackberry.bbm.platform.self.setStatus("busy", "Getting a new high score", function (accepted) {
    if(accepted) {
        // User allowed the change
    } else {
        // User denied the change
    }
});
blackberry.bbm.platform.self. setPersonalMessage ("I’m loving this app!", function (accepted) {
    if(accepted) {
        // User allowed the change
    } else {
        // User denied the change
    }
});

Profile Boxes

Profile Boxes provide yet another way for an application to promote itself to a user’s BBM contacts. They appear within the Apps area of a user’s profile and are ideal for sharing what a user is doing within an application. Every application that is connected to BBM SP appears in the list. Applications can create profile box items that appear under their application header. You can supply a custom image and string, which is used to create the profile box item.

The ability to add a profile box item using BlackBerry WebWorks is not yet supported on BlackBerry 10, but you can do it on BlackBerry OS 5-7. There are C and C++ APIs for populating the profile box on BlackBerry 10, so you could accomplish this by building a custom BlackBerry WebWorks extension.

When creating a profile box item, use of the image is optional. If you don’t wish to include an image, you can omit it from the options variable.

var options = {text:"No one’s ever beat me at solitare!", icon:"local:///cardshark.jpg", cookie:"unbeatable"};
blackberry.bbm.platform.self.profilebox.addItem(options);

Contacts

An application can retrieve a list of BBM Contacts who have the same application installed. This list can be used as selection criteria for connecting for a multi-user experience. Events are also fired for changes to this contact list, allowing your application to keep track of both the addition and deletion of contacts in the contact list itself and/or changes to individual contacts.

Currently, working with BBM contacts is not supported using BlackBerry WebWorks for BlackBerry 10, but there are APIs for WebWorks for BlackBerry OS 5-7 as well as C and C++ APIs for BlackBerry 10. Further support for this in BlackBerry WebWorks for BlackBerry 10 is planned for a December release. Watch the BlackBerry WebWorks roadmap for updates.

Wrapping It Up

That wraps up my intro post for getting started with the BlackBerry Messenger Social Platform using BlackBerry WebWorks. Now it’s up to you to make use of these APIs in your next hit application, which could be featured on the Connected App Showcase.

In this next blog post, we’ll cover the technical aspects of how you can use the BBM SP within your application. I’m going to assume that you are using the BlackBerry Native SDK to create a Cascades™ application using the Qt style BBM SP APIs. The same functionality is available at the c level in the style of the BlackBerry Platform Services library. If you are already using BPS within your application, you could use it for BBM SP as well, but in general I recommend using the Cascades BBM SP APIs instead because they’re easier to use.

Testing an application BBM SP application for BlackBerry® 10 currently requires a real device. We’re working on adding BBM SP support in the BlackBerry 10 Simulator and this should be available before the end of 2012.

Configure Your Project

The first step is to configure your project in the BlackBerry Native SDK, adding the BBM SP libraries and permissions.

Open bar-descriptor.xml and click on the General tab. Within bar-descriptor.xml click on the Application tab and check off BlackBerry Messenger in the Permissions box.

Now it’s time to add the BBM SP library. Right click on your project and choose Configure -> Add Library. Click Next and filter for BBM. Add the libbbplatformbbm library. Follow the steps in the wizard and add the line below to your .pro file.

LIBS += -lbbplatformbbm
LIBS += -lbbsystem

Register with the BBM Social Platform

Registration is the first step in connecting to the BBM Social Platform, which involves an application registering itself with the RIM®-hosted BBM infrastructure. A sample called BBMRegistration is available on the BlackBerry github site. It demonstrates BBM SP registration, so have a look at it once you’ve finished reading this section for the complete version of the code snippets used here.

Each application must define its own Universally Unique Identifier (UUID) so that it can uniquely identify itself. This UUID is used to register with the BBM SP servers during testing and development. Applications in the BlackBerry App World™ storefront are assigned their own UUID automatically.

// Attempt to register the application with the following UUID.
//Define your own UUID.  You can generate one here: http://www.guidgenerator.com/
m_uuid = QString::fromUtf8("c0fef20e-5f94-4eb1-be1e-e055f2c2391c");

Next, create a new instance of the BBM platform context.

m_context = new bb::platform::bbm::Context(QUuid(m_uuid));

Now connect the registrationStatusUpdate signal with a slot in your application. In this example, I created slot called registrationStatus.

QObject::connect(m_context, SIGNAL(registrationStateUpdated(bb::platform::bbm::RegistrationState::Type)),
  			this, SLOT(registrationStatus(bb::platform::bbm::RegistrationState::Type)));

Now we’re ready to kick off the BBM SP registration process by calling requestRegisterApplication.

m_context->requestRegisterApplication();

Refer to the BBMRegistrationfor implementation details for the registrationsStatus. Once it receives a status of

case bb::platform::bbm::RegistrationState::Allowed:

our application will be ready to use the rest of the BBM SP APIs described below. Also note m_context used above — it’ll be used throughout the rest of the examples.

Invite to Download

The invite to download feature allows users of your application to invite their BBM contacts to download your application from BlackBerry App World. The recipient receives the invitation through a BBM Chat session, which includes a message provided by the application and the user sending the invitation. This is one of the easiest features to implement. After you’ve registered, you can do this with just two lines of code.

The first line instantiates the MessageService object and the second kicks off the invite to download process. The user would then be prompted to select the BBM contacts they want to send the invitation to.

m_messageService = new bb::platform::bbm::MessageService(
				m_context, this);
m_messageService->sendDownloadInvitation();

We have a complete sample for this feature as well called BBMInviteToDownload.

Note that for this to work between BlackBerry 10 and BlackBerry® OS 5-7 users, the SKU in BlackBerry App World for the two releases of the application (BAR and COD) must be the same.

Profile Integration

BBM SP allows for both read and write access to the user’s BBM profile. This allows your application access to their profile message, status text, availability and avatar image. To see more, have a look at the BBMProfile sample. Let’s learn how to update the user’s personal and status messages in BBM.

If an update to a personal message was made from an application other than the BBM Client, a tag is shown under the update stating the name of the application that performed the update. Users can click on that tag to download the application from BlackBerry App World. This requires the sender to have installed the application from BlackBerry App World, so that tag won’t take you to BlackBerry App World if you side-loaded your application for testing. Let’s take a look at how to update the personal message and status.

The first step is to get an instance of the user’s BBM profile:

m_userProfile = new bb::platform::bbm::UserProfile(m_context, this);

With that, we can update the user’s BBM personal message or status. Here’s how we can do both with just three lines of code:

QString personalMessageString = "Best app ever!";
m_userProfile->requestUpdatePersonalMessage(personalMessageString);
m_userProfile->requestUpdateStatus(false, statusMessageString);

The boolean false being passed into requestUpdateStatus is the flag to set the free/busy indicator shown beside their BBM status. If we had updated their status to something like “Don’t bug me I’m busy playing Slingshot 5000” we’d likely set that to true.

Contacts

An application can retrieve a list of BBM Contacts who have the same application installed. This list can be used as selection criteria for connecting for a multi-user experience. Events are also fired for changes to this contact list, allowing your application to keep track of both the addition and deletion of contacts in the contact list itself and/or changes to individual contacts.

Step one is to get an instance of the ContactService.

m_ContactService = new bb::platform::bbm::ContactService(m_context, this);

Once we have that, we can retrieve the BBM contacts that also have the same application installed. The sample code below prints out the display name of all contacts retrieved to the BlackBerry Native SDK console.

if (m_ContactService->contactCount() > 0)
{
	foreach (const Contact &contact, m_ContactService->contacts())
	{
		qDebug() << contact.displayName();
	}
}

To listen for updates to a user’s contact list and/or the contacts themselves, we can connect a slot to the contactListUpdated and/or contactUpdated signals. Here’s an example of connecting them to handleUpdateContactList and handleUpdateContact slots.

QObject::connect(m_ContactService, SIGNAL(contactListUpdated()), this, SLOT(handleUpdatedContactList()));
QObject::connect(m_ContactService, SIGNAL(contactUpdated(const QString)), this, SLOT(handleUpdatedContact()));

The handlers would take care of updated any in application resources that reference the users BBM Contacts.

Wrapping It Up

I hope this helped you get started in implementing some features of the BBM Social Platform into your application, or at least convinced you how easy it is to do. I look forward to seeing your innovative uses of the BBM SP. Your application could be the next one featured on the Connected App Showcase.

Come back next week if you are a BlackBerry® WebWorks™ developer — we’ll have a post similar to this one, but demonstrate these features using the BlackBerry WebWorks APIs.

Everyone here in Developer Relations at RIM® is excited that developers are now able to submit their BlackBerry® 10 applications to the BlackBerry App World™ storefront and target BlackBerry 10 Dev Alpha testing devices. This means that developers who are using the BlackBerry 10 Dev Alpha testing devices will be able to download and test each other’s applications through BlackBerry App World.

How do you submit an application? It’s the same process you’d use for any other BlackBerry® smartphone or BlackBerry® PlayBook™ tablet app – you just need to select the BlackBerry 10 Dev Alpha for your app.

Next, apps are vetted for content to ensure that the BlackBerry App World Vendor Guidelines are adhered to. Then they’re tested to ensure they do not interfere with the normal operation of the BlackBerry 10 Dev Alpha testing device. You may be contacted by a member of the Review Team if they run into any problems or have any questions/concerns. This entire process normally takes a five to ten business days.

Once your application is Approved, it will automatically be posted Up for Sale. You can opt out of this automatic posting during the submission process, but must be done prior to submitting your application(s) for approval. Keep in mind it may take a few hours before your application is searchable and visible in BlackBerry App World.

The recent update to the OS on the BlackBerry 10 Dev Alpha testing devices includes a BlackBerry App World client, so developers will have to update their test devices to access apps. Additionally, anyone that visits the BlackBerry App World webstore will be able to see your application after you click “Post for Sale”. Please ensure that you use app Icons and descriptions with that in mind.

You can also choose to leave the application in an Approved status. This allows you to deep link to your application using the AppID (found on the Details page of your application). Using the standard Web Store URL, you can deep link to your application from a device. The standard Web Store URL is http://appworld.blackberry.com/webstore/content/<AppID&gt;. You can download your application using the deep link for testing purposes and you can share this link with select users for targeted testing.
All applications on the store can be reviewed, but only by users who purchase or download the application. Use these reviews for your testing purposes. These will be reset when you submit your application for commercial release of BlackBerry 10.

As a BlackBerry App World vendor with an application live in the store, you are able to generate download and purchase reports for your app.

Finally, we recommend that your app is available for free as this is a testing period. However, we do allow you to charge for your app and test in-app payments.

Happy testing and we look forward to seeing all your great apps!

When BBM™ Connected applications instantiate BBMPlatformApplication, they must supply a UUID. The UUID is a 128-bit universally unique identifier for the application that must be 36 characters long and comply with the Microsoft® 8-4-4-4-12 format. Those numbers represent the number of characters in each sequence, separated by a dash. Here is an example of a UUID in the correct format: 4995d07c-13ee-42d1-92bb-90ba6ed33e1d. You can manually create a UUID or use an online UUID generator.

Using a UUID that doesn’t comply with the Microsoft 8-4-4-4-12 format can prevent your application from connecting to the BBM test/pre-production environment. If you do use an incorrect UUID format, you could receive an error of “Unable to connect to BBM. [App name] disconnected by RIM” when trying to connect. This only affects developers using the test/pre-production environment. Consumers who have purchased the application from the BlackBerry App World™ storefront will remain unaffected because BlackBerry App World will assign unique identifies to applications when they are put up for sale.

The UUID is used to uniquely identify an application in the test/pre-production environment. Once you upload the application to BlackBerry App World, it is no longer used. Changing your UUID allows you to perform tests of your application in isolation of one another.

Yesterday at BlackBerry® 10 Jam, we held an AppCircus event. Developers registered their apps for the contest last week and three finalists were chosen for each category – BlackBerry® WebWorks™, Adobe® AIR®, and Native – earlier this week. The nine finalists had three minutes each to pitch their apps to a panel of judges that included our own Alec Saunders, Bob Taniguchi and Peter Valin. Also joining the judging panel was Kevin Michaluk of Crackberry.com fame, as well as Peter Hansen, Michael Brooks and Jeremy Adams, some of our most recognized community members. All of the finalists have their apps working on (or being finalized for) the BlackBerry® PlayBook™ tablet, and several had a running version on their BlackBerry Dev Alpha device.

The BlackBerry WebWorks finalists:

B’Giftee is a real world social sharing app that lets people gift real-world items to others. If you go to a restaurant and like the burger there, you share that knowledge and offer friends a gift of the burger – a reward that could be for the first to take advantage or for all involved.

2Scoops allows people to find the best gelato in Rome, Paris, New York and London, and also gives pronunciation for ordering in Italian. It includes map integration, business hours and ratings and reviews.

Pesktop creates a desktop feel on the BlackBerry PlayBook tablet with video playback, audio playback, note-taking and picture viewing all in one place.

The Adobe AIR finalists:

Cooklet is a guide to cooking that includes recipes with shopping list integration, gesture interation through the camera, photo and recipe libraries and more.

Nobex Radio allows people to listen to radio stations from their BlackBerry® smartphones or BlackBerry PlayBook tablet. They have a selection of over 16,000 stations and have worked to integrate social features for sharing stations and songs.

Nexus is a direct BlackBerry PlayBook tablet to BlackBerry PlayBook tablet file-sharing app that allows people to share content over their local network without using any mid-server.

The Native Finalists:

Training with Messi is a soccer game that uses device motion and hand gesture controls to take Messi down the field. This app has Scoreloop integration with leaderboards and achievements.

DOO-DOo-Doo allows people to play piano on the BlackBerry PlayBook tablet and goes beyond a normal keyboard with pre-recorded sounds. People can even adjust the tones and harmonics.

Kami Retro is a new game with an old-school feel that takes the fun of 80’s and 90’s side-scroller games and brings it to the BlackBerry PlayBook tablet.

The winners were B’Giftee, Cooklet, and Training with Messi. All three had their apps working and running on the BlackBerry Dev Alpha device. They also had the apps working during their initial pitches, which took place the day that they got the device.

Winners received $25,000 to go see their favorite bands in concert! More details are available at http://devblog.blackberry.com/2012/04/blackberry-10-jam-appcircus/

Congratulations to everyone!

Some of the new APIs being introduced include:

Scoreloop™ SDK 2.0: Our Scoreloop social gaming SDK provides APIs to set up user profiles and global leaderboards, award achievements, and challenge other players. Game developers in particular can enhance their games by adding cool new functionality for social gaming.

Payment APIs: Our payment APIs will help facilitate the integration of in-app payment processing mechanisms in apps.

Battery Monitoring and LED Control: These APIs will give apps access to hardware components on the device. Battery monitoring in particular will allow our applications to read the battery level, so they can inform their users about potential loss of data if the battery level is too low to complete an activity. It also allows an app to register for battery level notifications so that it can receive low battery warnings and handle them accordingly.

On the tooling side, we are introducing a limited beta version of the new BlackBerry® Plug-in for Microsoft® Visual Studio. We’ve been listening to our game developers who develop their titles using the Visual Studio IDE, and this plug-in will now make it easier for these developers to adapt their games for our platform. The Visual Studio plug-in provides options to register for code signing keys, create developer certificates, create and upload debug tokens as well as to build and run applications on the BlackBerry® PlayBook™ OS 2.0 and BlackBerry 10 platforms. The plug-in can be installed with either Visual Studio 10 Standard or Professional edition, though it is still in Beta and lacks support for features such as debugging. We are interested in getting your feedback as you start it to build your apps, and would like you to report any issues or concerns through our BlackBerry developer support forums, which are monitored regularly.

This new BlackBerry 10 Native SDK is just the start of the journey. We will be bringing additional APIs along with associated tooling improvements, and we are continuing to work with our third party partners and developers to ensure that their needs and requirements are being taken into account as we continue to release new functionality. This will not only help our developers build and monetize their apps for BlackBerry, but also enrich our BlackBerry App World™ with new and exciting content.

The BlackBerry® Developer Relations team here at Research In Motion® (RIM®) continues to make amazing strides in reaching out to the developer community. This weekend – March 30th and 31st – we’ll be hosting a HTML5 hackathon for students with Pace University in New York City. We collaborated with Pace University to create an opportunity for students to learn how to develop in HTML5 and take mobile apps to the next level with our BlackBerry® WebWorks™ platform.

Adam Stanley, Patrick Mollins and Erik Oros from the Developer relations team will be on-hand to help guide students as they work with the BlackBerry platform and to give them some tips and tricks, as well as lead some sessions to help these developers gain insight into our web tools.

Students can choose to develop an HTML5/BlackBerry WebWorks application around one of the topics suggested by RIM experts prior to the event or use their own imagination to come up with an app idea and work under RIM experts’ guidance to implement it as a BlackBerry smartphone or BlackBerry® PlayBook™ tablet app. A total of three winners will be selected by a jury of three-five experts from Pace University and RIM at the end of the two days and recognized with prizes including free participation at one of RIM’s upcoming developer conferences.

We’re hoping that at the end of the event, students will have a working prototype or full-fledged BlackBerry application which leverages HTML5/BlackBerry WebWorks technology.

This event is intended to be the first in a series of Future Developer Days focused on student participation as part of our BlackBerry Jam Program. For more details on the BlackBerry Jam Program please visit https://bdsc.webapps.blackberry.com/devzone/jamcommunity.

Stay tuned here for more info from the event and to learn about the winning apps and developers.

Today, I am very excited to introduce you to BlackBerry® Device Service, which is the component of BlackBerry® Mobile Fusion used to manage BlackBerry® PlayBook™ tablets and future BlackBerry® 10 devices. BlackBerry Mobile Fusion is RIM’s new unified multi-platform MDM (mobile device management) solution for managing in market BlackBerry OS devices, BlackBerry 10 devices, and iOS and Android™ devices as shown in the image above.

Why should you be excited about the launch of BlackBerry Device Service together with BlackBerry PlayBook OS 2.0? Well that’s simple. For those of you new to enterprise mobility, especially when it comes to BlackBerry, we’ve always had the secret sauce to enable your enterprise mobile applications to seamlessly connect to your backend application server with no need for an enterprise VPN. This secret sauce was our BlackBerry Mobile Data System (MDS) which abstracted away much of the wireless network complexities and provided an end to end, AES secure connection for enterprise application developers.

For those of you that have been long waiting for this feature, look no further as we are bringing this functionality back to BlackBerry PlayBook OS 2.0 and future BlackBerry 10 devices. Just imagine if you were an insurance adjuster in the field and wanted an application:

• pushed to your BlackBerry PlayBook tablet
• to seamlessly upload both vehicles pictures and a brief description to your application server that resides behind your corporate firewall

Together with BlackBerry Device Service and BlackBerry PlayBook OS 2.0, these problems are solved! This is exactly what we have enabled both the corporate customers and enterprise developers to implement.

Although customers have long had the ability to push applications to BlackBerry users with a BlackBerry Enterprise Server, this is the first time we are introducing a user self-serve portal to manage all enterprise applications – right from BlackBerry App World™. With BlackBerry Balance™, enterprise applications are installed within a corporate perimeter on the device. For more information on BlackBerry Balance, be sure to read this blog post from the Inside BlackBerry Blog, and check out the BlackBerry Balance website as well.

Together, these features will protect all your resident enterprise application data within the corporate perimeter and at the same time provide a secure AES encrypted pipe to transport your data securely from behind the firewall. This is exactly why I share this excitement with all our enterprise development community today.

If you haven’t already done so, I would check for BlackBerry PlayBook OS upgrades and immediately upgrade your device to BlackBerry PlayBook OS 2.0. You can also download a free trial of BlackBerry Mobile Fusion today.